Privacy Policy

This Privacy Policy explains how Odyx Societe Anonyme (Odyx S.A., “Odyx”, “we”, “us”, or “our”) processes personal data in connection with our corporate website, our fungy.ai website and related business communications, and, where applicable, our provision of the fungy.ai platform to enterprise customers.

This Policy is designed to align with the contractual framework used for fungy.ai subscriptions, including the applicable Master Services Agreement (“MSA”), Data Processing Agreement (“DPA”), Order Forms, and related security commitments.

1. Who We Are

Odyx Societe Anonyme (Odyx S.A.)

Registered address: 103 Harokopou Str., 17676, Kallithea, Athens, Greece

VAT No.: 802537581

Email for privacy inquiries: dpo@odyx.ai

2. Scope of This Policy

This Policy applies to personal data processed in connection with:

• use of the Odyx website and fungy.ai marketing pages;
• requests for demos, meetings, contact, newsletters, or other business communications;
• business relationship management with prospects, customers, suppliers, and partners;
• security, administration, and operation of websites and related communications;
• limited platform-related processing where Odyx acts as an independent controller, such as account administration, service communications, security logging, and fraud or misuse prevention.

3. When Odyx Acts as Controller and When It Acts as Processor

Depending on the processing activity, Odyx may act either as a data controller or as a data processor.

3.1 Odyx as Controller

Odyx acts as controller for personal data processed for our own purposes, including when you:

• visit our website
• submit a contact form, request a demo, subscribe to updates, or otherwise communicate with us;
• act as a prospect, customer representative, supplier, advisor, or business partner;
• receive operational, legal, billing, or account-related communications from us;
• are associated with security, fraud-prevention, audit, abuse-prevention, or compliance records that we maintain for our legitimate business purposes.

3.2 Odyx as Processor

When Odyx provides the fungy.ai platform to an enterprise customer, the customer generally acts as data controller and Odyx acts as data processor for personal data contained in Customer Data and processed on the customer’s behalf in connection with the Services.

This typically includes personal data contained in uploaded business documents, workflow content, business cases, requirements, stakeholder inputs, and other customer-provided data processed through the platform.

If you are an authorized user of fungy.ai through your employer or another enterprise customer and wish to exercise rights regarding Customer Data, you should normally contact your organization first. Odyx will assist the relevant customer as required under the applicable MSA and DPA.

4. Categories of Personal Data We Process

4.1 Website and business relationship data

• name, business email address, business phone number, company name, job title, department or function;
• contact form content, correspondence, meeting requests, and business communications;
• newsletter or event registration details, where applicable;
• billing and commercial contact details of customer or prospect representatives.

4.2 Platform-related account and operational data

• user identity and access data, such as name, business email address, role, department, organization, and account identifiers;
• authentication-related data, including SSO-related identifiers where enabled;
• audit log data, activity records, notifications, workflow actions, and support records;
• technical and usage data, such as IP address, browser or device information, timestamps, and service diagnostics.

4.3 Customer Data processed on behalf of enterprise customers

• professional information contained in Customer Data uploaded to fungy.ai, including business documentation, stakeholder inputs, business cases, requirements, comments, workflow content, and related materials;
• personal data relating to customer employees, contractors, business stakeholders, and individuals whose professional details appear in uploaded business documents.

4.4 Special categories and sensitive data

fungy.ai is not intended for the routine processing of special category data, criminal offence data, children’s data, government ID numbers, financial account data, health data, or other highly sensitive personal data unless expressly agreed in writing and supported by appropriate safeguards.

Customers are responsible for determining whether they are authorized to upload personal data to the platform and for ensuring that they have the necessary notices, lawful bases, permissions, and internal approvals.

5. Sources of Personal Data

We may collect personal data directly from you, from your employer or organization, from communications and meetings with you, from website forms and cookies, from public professional sources such as corporate websites or LinkedIn profiles where appropriate for B2B outreach, and from enterprise customers using fungy.ai.

Where Odyx acts as processor, personal data is typically provided to us by the relevant enterprise customer or its authorized users.

6. How We Use Personal Data and Legal Bases

Where Odyx acts as controller, we process personal data for the following purposes and legal bases:

Purpose	Legal basis
Responding to inquiries, demo requests, meetings, and general business communications	taking steps at your request before entering into a contract; legitimate interests
Managing customer, supplier, and partner relationships	performance of a contract; legitimate interests
Operating, securing, administering, and improving our websites and services	legitimate interests
Account administration, service notices, billing, renewals, and related operational communications	performance of a contract; legitimate interests
Security logging, misuse prevention, fraud prevention, incident response, and business continuity	legitimate interests; legal obligation where applicable
Compliance with legal, tax, accounting, regulatory, and audit obligations	legal obligation
Sending newsletters or marketing communications where required by law	consent, and in some cases legitimate interests where lawful
Website analytics and performance measurement	consent where required by law, or legitimate interests for strictly necessary and low-impact analytics where lawful

7. AI-Assisted Processing and Domain Knowledge

fungy.ai includes AI-assisted features that may generate probabilistic outputs, recommendations, summaries, analyses, or structured content. Such outputs may contain inaccuracies, omissions, or incomplete information and are intended to support, not replace, human judgment.

The platform is designed as a human-in-the-loop decision-support system and does not autonomously execute binding financial, regulatory, employment, procurement, or operational decisions.

Where the Domain Knowledge feature is enabled, customer documentation may be processed solely to extract structured knowledge and support the customer’s use of the Services.

• Such processing may occur within controlled computing environments designed to limit unnecessary exposure and restrict access to only those system components and personnel reasonably required to perform the processing.
• Where applicable, content may be programmatically transformed, labeled, summarized, pseudonymized, or anonymized in accordance with the design of the relevant feature.
• Raw uploaded documents are not intentionally retained longer than reasonably necessary for processing, troubleshooting, security, legal compliance, backup cycles, or agreed service operation.
• Customer-specific derived artifacts, such as metadata, embeddings, labels, summaries, structured knowledge objects, and similar transformed outputs, may be retained for the customer’s benefit during the subscription term and any limited post-termination period reasonably necessary for transition, security, backup cycles, dispute preservation, or legal compliance.
• Odyx does not use Customer Data, raw uploaded documents, or customer-specific derived artifacts to train public foundation models, and does not knowingly use them for cross-customer model training, benchmarking, or analytics unless expressly agreed in writing by the customer.

Separately from fungy.ai, enquiries submitted through the contact form on this website are assessed with automated assistance, to help us judge whether an enquiry concerns a genuine business matter. For that purpose the enquiry, including your name, email address, company and message, may be sent to a third-party model provider.

The result is a suggestion shown to a member of our team. It does not by itself create, alter, or reject any record, and a person decides whether and how we respond. Where such a provider is located outside the EEA, the transfer safeguards described in section 9 apply.

8. Recipients of Personal Data

Depending on the context, personal data may be disclosed to or processed by:

• authorized Odyx personnel on a need-to-know basis;
• hosting, infrastructure, backup, and security providers;
• identity, authentication, email, support, analytics, and productivity service providers;
• AI and machine learning providers engaged to support fungy.ai functionality;
• AI and machine learning providers engaged to assess enquiries submitted through the contact form on this website, where the assessment is advisory only and is reviewed by a person;
• professional advisers, auditors, insurers, financing or diligence recipients, and corporate transaction counterparties, subject to appropriate confidentiality protections;
• public authorities, regulators, courts, or law enforcement where required by law;
• our customer relationship management (CRM) system, which collects enquiries submitted through the contact form on this website;
• our human resources management system (HRMS), which collects applications submitted through the careers pages of this website.

For fungy.ai, Odyx maintains an up-to-date list of material subprocessors relevant to the Services through an external notice mechanism or upon request, as described in the applicable contractual documentation.

9. International Data Transfers

Where personal data is transferred outside the EEA, UK, or Switzerland, Odyx will use an appropriate transfer mechanism recognized under applicable law, such as:

• an adequacy decision;
• the European Commission’s Standard Contractual Clauses or equivalent lawful transfer safeguards;
• the EU-U.S. Data Privacy Framework, where applicable.

The exact mechanism may depend on the relevant recipient, service provider, and processing context.

10. Security Measures

Odyx implements reasonable and appropriate technical and organizational measures designed to protect personal data against unauthorized access, disclosure, alteration, or destruction.

• role-based access controls and least-privilege principles;
• encryption in transit and encryption at rest for supported storage layers;
• logical segregation of customer environments in a multi-tenant architecture;
• logging, monitoring, and administrative access controls;
• vulnerability management, secure development practices, and incident response procedures;
• backup and recovery measures appropriate to the Services;
• confidentiality obligations and security awareness measures for relevant personnel.

No method of transmission or storage is completely secure. We therefore cannot guarantee absolute security, but we apply controls appropriate to the nature of the services and the risks involved.

11. Data Retention

Where Odyx acts as controller, we retain personal data only for as long as necessary for the purposes described in this Policy, including to manage our relationship with you, comply with legal obligations, resolve disputes, and enforce our agreements.

Where Odyx acts as processor for fungy.ai customer data, retention is governed primarily by the applicable customer contract.

For data submitted through this website specifically:

• Contact enquiries: your message and contact details are transferred to our CRM, which becomes the system of record. The copy held by this website is removed automatically no later than 24 months after submission, and sooner once the CRM has collected it.
• Job applications: your application and CV are transferred to our HRMS, which becomes the system of record and applies its own retention periods. The copy held by this website is removed as soon as the HRMS confirms collection, and in any event within 30 days.

You may ask us to delete either at any time, using the contact details in section 1.

• Customer Data and reasonably available customer-specific generated materials may generally be made available for export or retrieval for up to thirty (30) days after expiration or termination of the applicable subscription, to the extent technically feasible and upon request.
• After that period, Customer Data is generally deleted or rendered inaccessible within sixty (60) days, subject to retention required for backup cycles, legal compliance, dispute preservation, fraud prevention, or security purposes.
• Certain transformed artifacts derived from Customer Data may be retained only to the limited extent permitted by the applicable contract and data processing terms.

12. Your Rights

Subject to applicable law, individuals may have the right to request access, rectification, erasure, restriction of processing, portability, objection, and withdrawal of consent where processing is based on consent.

If Odyx acts as controller for your personal data, you may submit your request to dpo@odyx.ai.

If your data is processed by Odyx on behalf of an enterprise customer through fungy.ai, you should normally direct your request to that customer as the relevant controller. Odyx will provide reasonable assistance to the customer where required by the applicable DPA and law.

You may also lodge a complaint with the competent supervisory authority, including the Hellenic Data Protection Authority if Greece is the relevant jurisdiction.

13. Cookies and Similar Technologies

Our websites may use cookies and similar technologies for website functionality, security, analytics, and performance measurement.

Where required by law, non-essential cookies and similar technologies are used only with your consent. Further information is provided in our Cookie Policy.

14. Third-Party Links and Services

Our websites and services may contain links to third-party websites, platforms, or tools. This Privacy Policy does not apply to third-party services that we do not control, and we encourage you to review their privacy notices.

15. Changes to This Policy

We may update this Privacy Policy from time to time to reflect legal, technical, operational, or business changes. The updated version will be posted on the relevant website with a revised ‘Last updated’ date. Where required by law, we will provide additional notice of material changes.

16. Contact

If you have questions about this Privacy Policy or our processing of personal data, please contact:

Odyx Societe Anonyme (Odyx S.A.)

103 Harokopou Str., 17676, Kallithea, Athens, Greece

Email: dpo@odyx.ai